What is security service edge?
Security service edge (SSE) is a way of delivering an organization's security stack as a cloud service. Web filtering, control over cloud applications and access to private applications used to run on appliances in a headquarters data center, and remote users had to send their traffic there through a VPN to be inspected. With SSE, a provider runs those controls in points of presence (PoPs) spread around the world. Each user or office connects to the nearest PoP, the organization's policy is applied there, and the traffic goes on to the internet, a SaaS application or an internal application.
The analyst firm Gartner introduced the term in 2021 to name the security half of secure access service edge (SASE), a model it had described in 2019.
The services inside SSE
- Secure web gateway (SWG): filters and logs web browsing, scans downloads and checks uploads against data loss prevention (DLP) rules.
- Cloud access security broker (CASB): finds the cloud applications people use and controls data inside sanctioned SaaS tenants.
- Zero trust network access (ZTNA): connects a verified user on a checked device to one private application at a time, in place of broad VPN access.
- Firewall as a service (FWaaS): applies network firewall and intrusion prevention rules to traffic on every port, not only web traffic. Some vendors count it as part of SSE and others place it on the SASE networking side.
Most offerings add shared DLP policies, sandboxing of unknown files and remote browser isolation. Product bundles differ, so judge an SSE service by which of these problems it solves rather than by its label.
How traffic reaches the service
Managed laptops and phones run an agent that forwards traffic to the PoP and reports device posture, such as disk encryption and EDR status, for access decisions. Branch offices build IPsec or GRE tunnels from their edge router or firewall, which covers printers, phones and other devices that can't run an agent. Browsers on systems without an agent can be pointed at the service with a proxy auto-configuration (PAC) file, and unmanaged devices can reach a few web applications through a browser-only portal. Whatever the path, the same policy applies in the office, at home and on hotel Wi-Fi.
Example: one policy for a hybrid workforce
An engineering firm with 400 staff works from two offices and from home. Before SSE, every remote laptop ran a full-tunnel VPN so its web traffic could pass the proxy in the main office. Video calls stuttered, and people disconnected the VPN to get work done, which removed all inspection. After the move, the agent sends web and SaaS traffic to the nearest PoP, while internal design servers are published through ZTNA connectors that make only outbound connections, and the VPN concentrator is retired. A single rule, such as blocking uploads of files labeled Confidential to personal cloud storage, now applies to every user wherever they connect.
Design decisions and risks
- Provider visibility: the provider decrypts and inspects much of the organization's traffic, so due diligence, contract terms and TLS inspection exemptions for categories such as banking and health care belong in the design.
- Failure behavior: decide whether the agent fails open, letting traffic flow uninspected when the service is unreachable, or fails closed, blocking it.
- Dependence: internet access and private application access now rely on the provider's availability and on the agent working.
- Migration: most organizations run SSE beside their existing appliances for a period before retiring them.
SSE vs. SASE vs. SD-WAN
SD-WAN is networking: it links sites over broadband, fiber and cellular and steers each application over the best path. SSE is the security stack without the WAN. SASE combines the two, so a useful shorthand is SASE = SSE + SD-WAN. If a scenario only needs to protect remote users and SaaS use, SSE fits; if it also replaces branch routers and private circuits, it describes SASE.
Security service edge on the CompTIA Security+ exam
SSE is new to SY0-801 and sits under objective 3.2, which covers managing the security architecture that protects an organization's infrastructure. SASE no longer appears in the objectives, so expect questions to use SSE and its components. Wording such as "cloud-delivered security for users wherever they work", "remote staff need the same web filtering and app controls as the office without backhauling through the VPN" or "replace the on-premises proxy and the VPN with a cloud service" points to SSE. Distractors include SASE, when the scenario has no WAN element; SD-WAN, which steers traffic but isn't a security stack; a VPN concentrator; and a single component such as a CASB when the question asks for the overall approach.